The Browser Is the Worst Sandbox Ever Designed - <AUTHOR> https://bentrask.com/?q=hash://sha256/c8909ef4e934d5954f1ef8c8 <comment><USER2> > There are too many changes.

I am sorry, security guys, but unless it's military-grade software, security is just another feature. And it is not a highest priority one. Of course, security would be easier if there were no new features or spec changes. And software development in general would be much easier if there weren't any of those pesky end users.

Which is a good thing, probably. Otherwise, you'd be mostly out of your jobs. Security is always changing, chaotic battlefront.

Having said that, sandboxing is a good idea. Theoretically. But it is really hard to implement right — attack surface on the edges of the boxes is quite large. Remember those Java applets? They were sandboxed neck-deep, with excellent security model. Did it help?

<comment><USER3> The thing that you're missing here is that some of us do work on military- grade software _and we still need to use a browser_. We need to trust that going to a website won't leak information off of our HDs. I know a guy that builds fighter aircraft displays out of a giant clean room he built in his home. He was writing code for it on the same computer he was using for day to day work because he didn't really know any better (more of an Electrical Engineer than a software dev). My point is that you don't get to use the "it's just another feature" with some of this stuff.

For Counter Strike, sure. But for things like spreadsheets or web browsers, hundreds of thousands or millions of people working in arms manufacture or intelligence are going to be using your software and it needs to not leak designs to foreign intelligence agencies or competitors.

<comment><USER4> They need to fund development of a military grade browser then. Perhaps that might be a better investment than the F-35 for example?

<comment><USER5> I bet it would burn through a billion dollars, require a team of hundreds, take 10 years, then be so buggy would get cancelled.

I started off talking about the browser, not the F-35, but by the end the line blurred. :-)

</comment></comment></comment></comment><comment><USER6> I mostly disagree. A sandbox like seccomp with a truly minimal set of system calls allowed through (read, write, close, exit) is a _tiny_ attack surface and provides functionality roughly equivalent to raw Nacl. As far as I know, no holes have been found in seccomp configured like that. The problem isn't the sandbox per se, it's the set of services (3D! Audio! USB!) that are allowed through the sandbox. This proposal does nothing to help address that problem.

<comment><USER7> Exactly.

Every sandboxed app ever has needed native access of some sort to do something useful.

The best example of this difficulty is probably graphics (WebGL). To provide a compelling user experience, the API must allow apps to upload almost arbitrary code (shaders).

<comment><USER8> I'm genuinely curious what WebGL shaders can be used to do maliciously, and in what ways they can be considered arbitrary code?

<comment><USER9> They are arbitrary code, they just have to be written in GLSL. One of the vectors is the fact that less effort has been put into isolating and securing GPU memory, since previously, it was not considered sensitive. This is compounded by the fact that WebGL shader code and API calls are often processed by a layer with escalated privileges, written in C or C++, completely opaque, with lots of unknown bugs.

[http://www.kitguru.net/gaming/security- software/carl/webgl-e...](http://www.kitguru.net/gaming/security- software/carl/webgl-exploit-opening-browser-users-to-serious-attacks/)

[http://www.contextis.com/resources/blog/webgl-more-webgl- sec...](http://www.contextis.com/resources/blog/webgl-more-webgl-security- flaws/)

[http://www.pcworld.com/article/227438/dangerous_webgl_flaw_p...](http://www.pcworld.com/article/227438/dangerous_webgl_flaw_puts_firefox_and_chrome_users_at_risk.html)

<comment><USER10> Those 3 links are all to the same issue that was closed long ago and funded by MS as FUD.

There haven't been any real WebGL exploits I know of. No you can't upload arbitrary shaders either. They're validated and then re-written by the browsers.

<comment><USER6> And what does the validation and rewriting? Code in the sandbox? Code outside the sandbox? Code in a different sandbox?

</comment></comment></comment></comment></comment></comment><comment><USER11> If we can get the defect rate down to zero, then the product of that and the attack surface will still be zero.

If we can't do that, how much will sandboxing help? Sure, we can make a much smaller surface that we expose - let's say 1% of the size of what the browser currently exposes. Will that be good enough though? Xen's surface is about as small as you can get for a reasonable general-purpose sandbox, and, per the article, Xen has a lot of vulnerabilities too.

I think the only option is to push the defect rate down to zero. (This may be impossible; if so, we're all going to die. Computing power will inevitably advance to the point where any vulnerable system can be cracked by a lone terrorist, and economics and our inability to coordinate ensure that power plants, water treatment facilities, automated bioengineering facilities etc. are going to be computerized.)

Rust is, I think, worthwhile as a step on the road towards provably correct programs - memory management isn't everything, but it's something. Sandboxing OTOH feels like a dead end, because it's inherently ad-hoc and unprincipled.

<comment><USER12> Thanks for this comment. It's the first really substantiative response to my core thesis.

I don't think the math is on your side. As the defect rate approaches zero, there are diminishing returns to pushing it lower. On the other hand, the attack surface effect becomes overwhelming. Addressing both at once will be far more effective than concentrating on one or the other.

You might be right that in the long run, the defect rate needs to be 0.0. But that is a long ways away. Once we've picked the low-hanging fruit (including perhaps a provably correct sandbox), then we can start thinking about how to prove the correctness of random applications.

<comment><USER11> > I don't think the math is on your side. As the defect rate approaches zero, > there are diminishing returns to pushing it lower. On the other hand, the > attack surface effect becomes overwhelming. Addressing both at once will be > far more effective than concentrating on one or the other.

Huh? That's not how it works, is it? If we want to minimize X * Y and we currently have X = 50 and Y = 5, it's much more efficient to focus on bringing Y down.

> Once we've picked the low-hanging fruit (including perhaps a provably > correct sandbox), then we can start thinking about how to prove the > correctness of random applications.

"low-hanging fruit" tends to mean doing unprincipled things that can't be generalized / don't contribute anything in the long term, right? My view is that there's limited value in lowering the rate of security flaws in ways that aren't on the path to bringing it to zero. Getting it to zero will be valuable; halving it isn't really (there's some economic value in reducing the frequency of breaches, but not enough). So I don't think ad-hoc countermeasures are worthwhile.

To the extent to which a sandbox can be written in a principled/provable way it will be valuable. I'm not at all convinced that a general-purpose sandbox is possible, but that's a different question. (The techniques of factoring a program into pieces with the minimal capabilities that they need are valuable, but I think this needs to be done far more holistically than is possible with a sandbox; the security design needs to reflect the program design, because whether particular operations are safe or not is a function of the application-specific context. But this is very much speculation on my part)

<comment><USER12> > That's not how it works, is it? If we want to minimize X * Y and we > currently have X = 50 and Y = 5, it's much more efficient to focus on > bringing Y down.

I guess I see 0 as the asymptote. Like if you're already at 99.99% reliability, adding another 9 is quite hard. On the other hand, if you're at 10%, then there are big gains to be had.

> "low-hanging fruit" tends to mean doing unprincipled things that can't be > generalized / don't contribute anything in the long term, right?

I think sandboxes generalize much better than application-specific proofs. Once you have a provably correct sandbox (which I think is possible today, if you exclude things like 3D acceleration), you can run whatever you want in it: old software, games, Flash, Windows 98. Application-specific proofs only work for applications written in the approved way.

<comment><USER11> > Once you have a provably correct sandbox (which I think is possible today, > if you exclude things like 3D acceleration), you can run whatever you want > in it: old software, games, Flash, Windows 98. Application-specific proofs > only work for applications written in the approved way.

What would a generic sandbox enforce? That an application never accesses the network? That it never accesses the local filesystem? That it never communicates with another process? Browsers need to do all those things and more. I think you need application-specific knowledge to be able to enforce the restrictions that matter.

<comment><USER12> Yes, that is a good question. I think OpenBSD's pledge(2) is a good model for what a simple and useful privilege interface can enforce (although there is room for improvement).

To some extent, this is a question of what the requirements are. If a sandbox limits a browser to accessing certain files (a la chroot), is that secure? Or does it need to be more fine grained? This isn't something that can be proven, it's mostly a matter of user interface design.

I think there are good arguments for keeping security requirements relatively simple and coarse (including ease of implementation and making sure users can understand what guarantees are offered).

<comment><USER11> Hah, pledge is an example I was thinking of. I think it's too ad-hoc to deliver real security; I think it's more of an exploit-mitigation technology (comparable to something like ASLR), and as such ultimately a dead end.

<comment><USER12> I think it's worth distinguishing two problems with pledge:

1\. It's likely to have bugs because it's mixed with a constantly changing kernel and can't be proven correct

2\. It isn't fine-grained enough

If pledge were completely bulletproof, but still limited in terms of what it could restrict, would that still be worthless? Granularity is an interesting problem but it's more subtle than typical criticisms of ad-hoc mitigations.

<comment><USER11> > If pledge were completely bulletproof, but still limited in terms of what it > could restrict, would that still be worthless? Granularity is an interesting > problem but it's more subtle than typical criticisms of ad-hoc mitigations.

I think the idea that you can allow a program to get itself in an attacker- controlled state and that will be ok as long as you blacklist what the program can do is fundamentally unworkable. So yes, I think pledge-like approaches are always going to be worthless in the long term - if the program is under the attacker's control, it will almost certainly have enough access to be able to do damage (with a sufficiently skilled attacker), because every program does something, particularly if we're talking about a large and complicated program like a browser. (You could potentially segregate the browser into multiple processes with distinct responsibilities, but I'm not convinced that helps, because those processes still have to send commands to each other and so an attacker who can subvert one can probably control the others).

If it had the level of granularity to express restrictions like "should be able to write only files that the local user has chosen via the save dialogue" then it might become an effective security layer, but at that point we're not really talking about a sandbox any more.

<comment><USER13> You are correct that pledge itself (or seccomp+namespaces on Linux) does not form a useful sandbox. These mechanisms are useful for blocking out the world, but not for re-establishing access to certain resources that the app needs to do its job.

> "should be able to write only files that the local user has chosen via the > save dialogue"

The web platform, incidentally, supports this! You can invoke a "choose file" dialog, and then your web page gets access to the one file the user chose.

In capability-based security circles, this pattern is called a "Powerbox". The pattern works especially well in capability systems, where it can be used to choose more than just files.

[https://sandstorm.io/how-it-works#capabilities](https://sandstorm.io/how-it- works#capabilities)

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> In fact, sandboxing the browser in a VM (which I think the author suggests, although he wants to go a more light-weight approach) with only limited file system access is what is done by many security-conscious enterprises such as banking. They usually embed Firefox in a Linux VM.

There is "Browser in the Box": [http://www.sirrix.com/content/pages/BitBox_en.htm](http://www.sirrix.com/content/pages/BitBox_en.htm)

And then there was also VMWare's Secure Browser Appliance (in 2005! although I cannot find any recent mentions of it): [https://rcpmag.com/articles/2005/12/13/vmwares-secure- browse...](https://rcpmag.com/articles/2005/12/13/vmwares-secure-browser- appliance.aspx)

Taking this to a new level by implementing a sandbox tailor-made for this purpose might be a worthwhile approach. However, for it to be effective you will always need to inconvenience your users: As soon as the browser running in the sandbox has access to the full filesystem, you are back to where you started. And if the browser does not have full access to the filesystem (but e.g. only to a specific "Downloads" folder as in the current sandboxes) you inconvenience your users: E.g. for uploading files, you first need to copy them to the Downloads folder.

<comment><USER6> > E.g. for uploading files, you first need to copy them to the Downloads > folder.

No, you need a "portal" or "intent" or "capability" whatever you want to call it. Browser asks sandbox to ask user to select a file, and browser gets that file. Android has been able to do this for a while, but full sdcard access is so easy that everyone uses it instead. Flatpak nee xdg-app will do this.

<comment><USER15> This capability system is exactly how OS X's built-in sandbox works. Sandboxed apps don't have unrestricted access to the filesystem, but if they invoke the system-provided Open dialog, and the user selects a file, the application is granted access to that file (which it can persist, so it can continue to access that file in the future).

</comment></comment></comment><comment><USER16> When I read things like this, I get a little hope that with the end of Moore's law, we will actually start improving the instruction set architecture in such a way that we can write performant software in higher-level languages instead of relying upon assembly++ languages like C, Go, and Rust.

I mean, with the number of VM languages out there like Java, PHP/Hack, .NET, various LISPs, etc. you'd figure that some hardware support for boxing/tagging/GC would be a standard feature by now, but nope. Instead, the best approach we have for secure and performant software with x86 is 1) write complicated system in tedious assembly++ 2) run under VM.

<comment><USER17> Back to Burroughs architecture (if only!)

[https://en.wikipedia.org/wiki/Burroughs_large_systems](https://en.wikipedia.org/wiki/Burroughs_large_systems)

<comment><USER18> Because a single architecture change will solve all our issues and not cause countless others (if only!).

<comment><USER19> Most likely not, but we surely wouldn't have the memory corruption ones.

</comment></comment></comment></comment><comment><USER20> When he asks for a sandbox to provide "a secure drawing API (including 3D, which, yes, is hard). You need a secure file system. You need secure network, and microphone, and webcam, and probably even USB. (It should also be possible to block or control access to each of these.)"

... isn't that the job of a normal OS kernel? The article may call it a "sandbox" but it sounds like normal access control in any OS, not much sandboxing left when asking for all the apis?

<comment><USER21> In-browser applications and virtual machine technology are both poor work- arounds to the same problem: that the design of modern operating systems gets it so badly wrong. If I can run completely different operating systems on top of another inside a VM application, why shouldn't I be able to run those other operating systems _as_ applications? If I can run Javascript downloaded from the internet that is JIT-compiled to native code inside a browser application, why can't I just run native code downloaded from the internet directly (with the same security - such as it is - as Javascript code). Why should I be able to access one set of APIs from Javascript code, and a different set of APIs from native C++ applications, etc.? Why should I be able to set up and migrate a development environment in a VM and transfer it between computers but I can't set up a separate development environment natively in the OS for just one or a few applications _and export it and all its dependencies_ just as easily as exporting a VM? In other words, if what I care about is about 15MB of customized files and 100KB of OS settings customization, why should I have to put 1.2GB of operating system files and other junk into a VM to make it sandboxed and portable? (I'm speaking in this latter example a Linux project called Code Data and Environment which accomplishes something like this by analyzing what files and shared libraries a running application accesses and packaging just those.)

<comment><USER22> This is a good comment. Operating systems were originally designed to protected people from each other. My process can't interfere with your home directory. My process can't mess up the entire OS (unless I'm admin). There was a time when most programs were not actively hostile to the user running them.

These days just about every application is user-hostile in some way. Even open source Windows applications, depending on where you download them from, might come with a hostile installer. Programs install background tasks. Programs track you.

Mobile operating systems have been a step in the right direction. But a good operating system should allow us to run whatever binaries we find anywhere on the Internet and not be able to do anything harmful to us.

<comment><USER20> Exactly. Better to improve the OS level sandboxing rather than duct-taping it all together with another layer of indirection via hypervisors. But it'll take a lot of work.

</comment></comment></comment></comment><comment><USER23> [https://xkcd.com/1200/](https://xkcd.com/1200/) nothing else to say.

<comment><USER24> That is indeed a very incisive critique, but what it and OP and this thread in general suffer from is a fuzziness about threat models.

Driver protections in the OS prevent people who write popular software from remotely taking over large numbers of computers. They're not intended to protect against your laptop getting physically stolen.

The OP here, on the other hand, I'm still confused what precise threat model it's concerned about :)

</comment></comment><comment><USER25> If your battle with invaders happens inside your home, then you have only one more misstep before game over.

"When asked whether it would be prudent to build a defensive wall enclosing the city, Lycurgus answered, "A city is well-fortified which has a wall of men instead of brick."

[https://en.wikipedia.org/wiki/Laconic_phrase](https://en.wikipedia.org/wiki/Laconic_phrase)

"It is said that if you know your enemies and know yourself, you will not be imperiled in a hundred battles; if you do not know your enemies but do know yourself, you will win one and lose one; if you do not know your enemies nor yourself, you will be imperiled in every single battle."

[https://en.wikiquote.org/wiki/Sun_Tzu](https://en.wikiquote.org/wiki/Sun_Tzu)

Moral: [https://en.wikipedia.org/wiki/Code_signing](https://en.wikipedia.org/wiki/Code_signing) \+ [https://en.wikipedia.org/wiki/Web_of_trust](https://en.wikipedia.org/wiki/Web_of_trust) \+ [https://en.wikipedia.org/wiki/Quality_assurance](https://en.wikipedia.org/wiki/Quality_assurance)

</comment><comment><USER26> Good luck getting Microsoft, Apple, Google and all the different Linux stakeholders into one boat on that :/ At least in the browser world there are standardisation efforts even if they don't work very well in different places, but it's the closest to the "write once run everywhere" for a platform we ever got. And it is the only remaining open platform where I don't need to enter a 'relationship' with a 'platform owner' to write and publish software for it (edit: except Linux of course).

I would like an OS-level sandbox that doesn't treat its users like idiots. But this is not what's currently happening (especially the "don't treat the user like an idiot" part). iOS and Android have always been closed platforms, and OSX and Windows are currently locked down at high speed.

The browser platform might be a mess, but it's less of a mess than the sum of all the underlying operating systems the browser is running on, and the only open-yet-secure platform that exists.

<comment><USER19> I actually don't care for the browser as anything more than interactive documents, so I am really looking forward to the Apple, Google and Microsoft efforts in sandboxing.

Specially in the way that they are also moving away from C as well.

<comment><USER27> Since that puts you in a small minority, I rather doubt that whatever they come up with will be well suited to your needs.

<comment><USER19> So far Gatekeeper, macOS X sandboxes and UWP do suit my needs.

</comment></comment></comment></comment><comment><USER28> The sandbox written in Rust can only be secure if the libraries it depends on, the compiler that was used to compile it, and the kernel as well as the compiler used to compile it and the libraries it depends on were _all_ written in Rust.

Furthermore, even if applications are sandboxed, that only prevents vulnerabilities from being exploited with other applications. A web page able to compromise my web browser would still be able to get all my browsing history, my usernames, my passwords… The sandbox would not help with that.

This does not necessarily make it worth it to rewrite everything in Rust, but it is worth considering writing any new software in Rust instead of C, especially if this new software is at a low level like compilers, the kernel, and libraries. Other applications can be written in a higher-level language with garbage collection and static typing instead of C.

<comment><USER12> A sandbox like NaCl doesn't depend on the kernel for security. In fact, it shields the kernel, which is good, because common OS kernels tend to have large attack surfaces of their own. The compiler of the sandbox needs to be reliable (so like CompCert, until Rust matures in this regard), but the compiler(s) of the software inside the sandbox don't matter.

You're right that stuffing _all_ of Chromium into a single sandbox would not be very good, because pages would be able to attack the browser (history, passwords, etc) and each other. You'd want to run each renderer in its own sandbox (which to some extent Chrome already does).

</comment></comment><comment><USER29> "The classic solution to every combinatorial explosion is modularity: separation of concerns."

What is the basis for this comment? It sounds reasonable, but how would one test it?

<comment><USER12> I don't actually have a cite for you, although it comes up in information theory. For example, guessing a password one letter at a time is (dramatically) easier than guessing the whole thing at once. I'd be curious to know what the term for it is.

Edit: "factoring" is one word for it.

<comment><USER30> I'd call it independence.

</comment></comment></comment><comment><USER31> Some points on sandbox design worth mentioning:

* The OS should be the sandbox. It has all the features of a sandbox; they just need to be secure.

* In addition to userland processes, if we trust the compiler of a high-level language without unsafe features (like Java), we should be able to compile programs with it and load them directly into the kernel. (User policy is enforced by the compiler.) This is similar to what Singularity does, and it has a number of advantages. First, since there is no task-switch boundary, we reap a speed benefit. Second is attendant to this; since there is zero cost to switch processes, people are encouraged to separate their applications into multiple processes, encouraging modularity.

* Second, the OS kernel itself should be written in a high-level language.

* Finally we need security in the compiler itself. This is achieved through the Futamura projections. That is, all that needs to written of the compiler is an interpreter; the actual compiler is condensed into the notion of a partial evaluator; the partial evaluator essentially figures out how to substitute any given program into the interpreter efficiently, hence compiling it.

</comment><comment><USER32> Anyone can help?

He is writing that the current browser sandbox model is not secure–all in a dramatic, clickbaity manner.

After many esoteric lines, then he says (maybe it's the tl;dr)...

"We need a highly secure (ideally provably secure) sandbox that doesn't have any features! Then, you can run an insecure browser inside, where security doesn't matter."

Then again some more lines of confusion.

So, what does he suggest? Putting the browser in a VM?

<comment><USER12> Put the browser in a VM/sandbox, yes.

tl;dr: Right now there is a competition between features and security, and security is losing. By separating them, they wouldn't need to compete, and we could have both. It isn't a good idea for a sandbox to directly handle things like CSS transforms.

Is my writing really esoteric?

<comment><USER32> Thanks for your reply and apologies for the 'esoteric'. Maybe not the right wording but I read your post few times and I would have liked to get more details about the idea.

The idea sounds ok once you clarified at the first glance but how does it work, will it work, what would be the implications. And many more questions. Currently I see the core idea surrounded by many vague statements.

And btw you can do this today already: just start a VM with a browser (might be a bit resource heavy and the integration into the main OS subpar). Or Docker with a browser. Not sure though if latter fulfills your security requirements.

But at the end, the browser is more then an isolated piece of software in a VM. An integration on OS-level is required and trivial stuff like a full- screen mode is possible but might complicate matters within a VM. Or 3d acceleration and everything where a direct access to the API is required. And suddenly the VM is piping everything through the main OS because a browser just needs access to all the OS APIs and then you end at square 1. So, I also find your idea a bit confusing.

</comment></comment></comment><comment><USER33> I think that partitioning and sandboxing software is underutilized, and that the Chromium sandbox is well designed.

But I don't know what sandbox escapes for Chromium look like? My guess would be that it involves things like browser plugins, or nasty stuff like WebGL. In which case sandboxing isn't failed, we're just not doing enough of it.

</comment><comment><USER34> I'm not sure, I understand this correctly, but doesn't this forget that the browser itself also contains sensitive information? So, for example login information would be inside the sandbox, and therefore you still need security in the browser...?

<comment><USER35> Ideally every website or tab would have their own sandbox.

</comment></comment><comment><USER36> Nice article, though there's a slight historical inaccuracy:

 _Blink raised the implementation quality bar with it's tab-per-process design and privilege dropping._

These were Chrome features, not Blink features. Blink didn't even exist when they were developed.

<comment><USER37> They really belong to the layer between Blink and Chrome: the Chromium Content module, the API that projects like node-webkit and Electron consume.

</comment></comment><comment><USER38> Sounds like this should be incorporated into the OS, rather than the browser.

</comment><comment><USER39> > _security risk is the product of defect rate multiplied by attack surface._

Call me crazy, but security sensitive application should not have direct access to 3D acceleration, microphone, camera, USB etc.

<comment><USER12> See the later quote:

> (It should also be possible to block or control access to each of these.)

The good news is that the capabilities of the sandbox don't need to be every- expanding, the way browsers have been. The sandbox should support everything the hardware can do, and then there are policy decisions about what capabilities web pages actually get.

<comment><USER39> It should also be possible to disable JS. We all know how that worked out.

<comment><USER12> A better analogy is Android permissions. These days you can fake them and apps mostly still work, right?

<comment><USER39> I think security model on Android 6 is now different. You can grant permission to use camera for 10 minutes etc...

</comment></comment></comment></comment></comment><comment><USER40> The best things suggested:

\- Strip down the features of the application to minimize attack surface. (see bloated, badly designed web apis...)

\- Don't let sensitive code be produced by interns.

<comment><USER41> And throw away years of progress in web technology. No, thanks.

What if I (and users) want those features? Ah, I remember, just install a plugin, which is closed source thus more secure... wait a minute.

<comment><USER42> A lot of that "progress" in web technology should be rolled back ASAP and just be remembered as a cautionary tale and/or used as a bedtime story for scaring little children.

<comment><USER41> If you remove them others will create even less secure alternatives. Remember Flash?

<comment><USER40> Let them. Don't use it.

</comment></comment></comment></comment></comment><comment><USER43> Rust isn't a sandbox. The whole point of a sandbox is it survives incorrect software at runtime. Rust is compile time magic. Sure, cool, different thing.

<comment><USER34> He's not saying that Rust is a sandbox, but rather that Rust should be used to write a sandbox.

</comment></comment><comment><USER44> I think what he wants is a browser that tie to a Docker container. Does browser on a container make any sense technically?

</comment><comment><USER45> You can already do a lot with Linux name-spaces. Every layer does help security though, but can slow down performance.

</comment><comment><USER46> Neat that this is the second article today on HN that mentions Qubes OS

</comment><comment><USER47> Worse is better.</comment>


Remaking MakerBot - <AUTHOR> http://motherboard.vice.com/read/remaking-makerbot

<comment><USER2> > "I'll be sitting at home. Maybe something broke; maybe my glasses." He grabs > the sunglasses on his desk, continues, "maybe I want to reprint it and I'll > go to Oakley, Ray Ban, whatever, Philippe Starck in this case, download the > file, pay $3.49 for it, and print it at home. And then you will have to go > to your Kinko's or your Fab Labs, your local 3D printing, if you want it in > metal or plastics you can't have at home."

Why would Oakley, Ray Ban, or Philippe Starck sell the design to their glasses for $3.49 when they can sell you the replacement pieces for three times more [1], or better yet sell you a replacement pair of glasses?

[1] [http://www.oakley.com/en/mens/sunglasses/replacement- parts/c...](http://www.oakley.com/en/mens/sunglasses/replacement- parts/category/m021103)

<comment><USER3> > Why would Oakley, Ray Ban, or Philippe Starck sell the design to their > glasses for $3.49 when they can sell you the replacement pieces for three > times more [1], or better yet sell you a replacement pair of glasses?

Because you want a poorly finished piece that takes multiple tries to print right because the extruder jams, piece warps, or a misaligned head crashes into the object turning everything into a goopy mess?

The occasional time my Replicator 1 works on the first try, it's magical. Most of the time it's an exercise in frustration.

</comment></comment><comment><AUTHOR> I'm a little confused why this 2,000-word article didn't even mention the open-source community backlash against MakerBot.

<comment><USER4> It reads like a lightly-edited press release. By far the biggest mis-step in the company's history and not a word.

<comment><USER5> I'd say the biggest misstep was the swelling of Bre Pettis' ego and subsequent firing of all of the original employees, including his own father, but the open source screwjob would be a close second.

<comment><USER6> The biggest misstep is the unusable 5th gen.

</comment></comment></comment></comment><comment><USER7> OT: Does anyone have information about the modular desk in the second picture? Any pointer would be appreciated.</comment>


Ask HN: Best hands-on security/cybersecurity training? - <AUTHOR> <comment><USER2> [https://www.offensive-security.com/](https://www.offensive-security.com/)

<comment><USER3> I would second that - the OSCP exam that goes with it is one of the best internationally recognised certifications

</comment></comment><comment><USER4> _THE_ hands on training to take is OffSec's starting with the PWK training (and accompanying OSCP certification).

[https://www.offensive-security.com/information-security- trai...](https://www.offensive-security.com/information-security- training/penetration-testing-training-kali-linux/)

Ran me something like $1,500 for the course and 90 days of lab time. Had a blast.

The CEH and Security+ certs are "hands off" certs. The CISSP is more oriented towards policy and higher-level stuff.

Obtaining the OSCP will make you immediately employable in at least a junior level position.

</comment><comment><USER5> [https://www.cybrary.it/](https://www.cybrary.it/)

From their homepage:

 _" Our free online IT and Cyber Security training classes include everything from industry certifications such as Certified Ethical Hacker, CISSP and CCNA to advanced niche skill sets like advanced penetration testing and cloud administration. Our training includes instructional lectures, interactive lab demonstrations, exam study guides, white papers, case studies and more."_

<comment><USER4> None of those mentioned certs involve advanced penetration testing, let alone basic penetration testing.</comment></comment>


First look: Windows Server 2012 brings the cloud down to earth - <AUTHOR> http://arstechnica.com/information-technology/2012/09/windows_server_2012_first_look/ <comment><USER2> Is it just me, or is Microsoft getting cool again ?</comment>


EyeWriter allows man to paint despite paralysis - <AUTHOR> http://gizmodo.com/5403741/eyewriter-allows-man-to-paint-despite-paralysis

<comment><AUTHOR> also, check out <http://eyewriter.org> for open source info (code / hardware). We've got instructions on instructables and software on svn / google code.

I was one of the developers of the software for this project. I can't tell you how great it was to collaborate with tony / TEMPT and to see his drawings come up on the side of the highway. I also worked on the car-font thing that was on HN a while back:

<http://news.ycombinator.com/item?id=724780>

</comment><comment><USER2> This is beautiful. A great example of hackers changing lives for the better.</comment>


Hydroxychloroquine Still Doesn't Do Anything, New Data Shows - <AUTHOR> https://www.wired.com/story/hydroxychloroquine-still-doesnt-do-anything-new-data-shows <comment><USER2> There are two studies reported. The first one [0] is a preprint (not peer- reviewed) so one should take it with a grain of salt. The second one [1] Figure 4 shows decrease of symptoms in people on the drug vs those on placebo, they are just not statistically significant enough to detect. Absence of evidence does not imply evidence of absence of the effect so I strongly argue against such bold titles.

Nevertheless, WHO has also discontinued such trials [2] but their findings are not yet published in peer-review. I guess more focus on the new vaccines now.

[0] [https://www.medrxiv.org/content/10.1101/2020.07.15.20151852v...](https://www.medrxiv.org/content/10.1101/2020.07.15.20151852v1.full.pdf) [1] [https://www.acpjournals.org/doi/10.7326/M20-4207](https://www.acpjournals.org/doi/10.7326/M20-4207) [2] [https://www.who.int/news-room/detail/04-07-2020-who- disconti...](https://www.who.int/news-room/detail/04-07-2020-who-discontinues- hydroxychloroquine-and-lopinavir-ritonavir-treatment-arms-for-covid-19)

<comment><USER3> Under the condition of having made competent attempts to come up with evidence, absence of such does very much imply evidence of absence.

Otherwise, you would have to check your left pocket again immediately after checking it and failing to find the keys you were looking for.</comment></comment>


DC Tech Summer: Common internship application for major startups in DC - <AUTHOR> http://dctechsummer.com/

<comment><USER2> Just a suggestion - I'm sure there will be other interns like me who found their way to DC without this program. It'd be great if there was some sort of listserv that interns could just join (without applying to the program) to find each other. I know there's DC Tech Meetup, etc, but it would be great to have a community of just interns.

<comment><USER3> There are some great places to find internships and individuals should not assume that just because someone calls something a common application that it is a gateway into all, most or even more than a few startups.

If you are an intern looking for an internship in the Washington, DC startup or tech community area you should join one of many startup discussions in the area and tell people you are looking.

If you are a programmer this means you should be announcing yourself in the programmer user groups - think DCRUG (Ruby on Rails) or BMore On Rails (Ruby on Rails) or NoVARUG (Ruby on Rails), DC Python (Python), etc. Most of these are on Meetup.org. There are also some great general discussion areas like DC Tech and Baltimore Tech on Facebook. Another great group to check out is Refresh DC - this is more web agency and web development and design oriented. Refresh Baltimore is similar.

In addition, there are a ton of great places to find out what is happening in the Washington area as well as to find out about startup and tech jobs and internships in the area. Craigslist has some great stuff. SocialMatchbox.com has some great stuff. DCTechEvents.com has some great stuff. BaltimoreTechEvents.com has some great stuff. There is also a Hacker News Meetup in DC - a great bunch of people are involved in it. Baltimore has a similar group that meets up called the Hacker Stroll, they go to a lot of different events together and have a monthly happy hour.

There are tons of great tech and startup companies in the Washington, DC area. The community is growing and very diverse. There are a ton of things going on and so many different people trying to come up with ways to organize all of it that it is hard to keep track of it all. No one website has all the answers or all the people so don't miss out on that.

<comment><USER2> Of course. But I'm no longer looking for an internship - I already found one.

Those other communities are great. However, a lot of that 21+ crowd socializes through happy hours - and I sadly wouldn't be able to participate. At this point I'm simply looking for a community of interns (people my age) with similar interests that I can contact for housing, lunch, pure social enjoyment, etc.

</comment></comment></comment><comment><USER4> Wish I was in school looking for an internship.

</comment><comment><USER5> applied :) agree with @deafcheese +21 restriction does not help students/interns to attend to good networking events</comment>


I'm starting it.  I will describe (almost) everything  - <AUTHOR>

Hello HN. I decided to start my own small, very small 'startup' which will provide web services. The goal is to make it in 60 days with no funds. The problem is that I have a full time job. I will share the most I can do on a blog especially made for that. Please comment !
blog : http://www.socialmkt.net/
Edit : Oh yeah and please, wish me luck ! <comment><USER2> Sounds like you're starting with a manageable but potentially useful site. You've researched the niche a little and it sound like there could be a market. That's a good start.

One suggestion - why not scrape or take some sort of feed (API/RSS available?) from the vendor's sites instead of relying on them updating your DB. It seems to me that relying on the input of any except the cheapest vendor might be a little unrealistic.

Oh yeah, best of luck!

<comment><AUTHOR> Hey thanks for your reply, I thought about taking some RSS feed but I got over two big obstacles:

\- most of the sites will provide only 10/15 rss items \- I really need specific informations about the products, like their unique Id on their side for example. Most of the time the rss feeds won't include that \- some website simply can't provide these feeds, unfortunately.

I hope to rely on xml feeds. Some vendors should be happy with the fact I proposed them to help them out about the feed I'm requesting</comment></comment>


All of PG's Essays in One PDF - <AUTHOR> https://pg.flomllr.com/essays.pdf <comment><AUTHOR> I wanted to read PG's essays on my Kindle, so I built a simple web scraper to convert them to one PDF file. The scraper runs once a day, so the PDF is always up-to-date. Maybe somebody finds it useful.</comment>


Arizona governor signs immigration bill - <AUTHOR> http://www.cnn.com/2010/POLITICS/04/23/obama.immigration/index.html

<comment><USER2> Those who get fired up over "illegal immigrants" have obviously never seen the insides of the immigration process. With all of the minutiae and red tape it's incredibly easy to find oneself on the wrong side of the law, even with the best of intentions. The complex requirements have so many traps and pitfalls that even the most earnest applicant can make a mistake that renders himself illegal.

</comment><comment><USER3> Simple solution: Make it MUCH easier to legally immigrate or work temporarily here.

Hire more INS workers, reduce backlogs, etc. but punish SEVERELY anyone who circumvents the improved process.

No excuses.</comment>


India announces nationwide lockdown to stop spread of coronavirus - <AUTHOR> https://www.axios.com/india-coronavirus-lockdown-fd753cb9-efbd-45b0-9008-16d51272c961.html <comment><USER2> As an Indian, here's a more cautious perspective:

1\. I am going with the assumption that community transmission might have started at some location; but with that assumption this 21-day lockdown becomes an imperative and excellent step.

2\. Will people obey the lockdown? (This is not a curfew, as essential services would be open.) Many people, sadly, would not. That is where the sometimes-criticized high-handed approach of police and other agencies would be useful.

3\. I am optimistic about this period. At the end of it, if nothing else, we would have more data points to make thoughtful decisions about how to proceed and what other measures need to be taken.

4\. Testing is being ramped up, and I hope it is an exponential ramp-up. Local test kits are also approved and beginning production today.

As a nation with 4X the population of the USA, and 1/3rd the area, the population density in India and particularly in the urban areas is off the charts. Hence, the approach suggested in some other countries, like carrying on with walks, exercises and other outdoor activities while practicing 'social distancing', gets much more difficult.

It is nearly impossible to be outdoors in urban areas and not have people nearby. As such, measures have to be very strict. I imagine the situation was similar in Wuhan in China, and they had to impose a complete lockdown as well.

<comment><USER3> I am more worried that the lockdown/curfew will be too stringent, and cause essential services to be shutdown. Many grocery shops etc are closed, as of now, there is no compulsion on them to remain open. Ideally, it would have been better naming it a partial-lockdown and assure the population that essential services shall be provided for without interruption.

<comment><USER2> With my privileged position in having the freedom to sit at home and work without interruptions, I can only try to be empathetic and imagine the hardships hundreds of millions of people will face.

There is no compulsion that I know of, but most of these businesses have associations and lobbies that will be dealing with the government and trying to keep things open. I have no doubt there will be disruptions all over the country. There are no precedents of such situations, nor would I expect any kind of Standard Operating Procedures to be in place.

It's gonna be chaotic - but hopefully not deadly. And that is the important thing.

Last few days, I have been thinking how disastrous a widespread infection would be in India. I shudder thinking about the numbers if this goes out of hand. A small percentage of 1.4 billion is a huge number. To avoid that, frankly, I'd accept temporary draconian measures.

I have been preaching "Stay at home" to everyone in my circles who would listen. Hope you do the same. :pray:

</comment></comment></comment><comment><USER4> Few things I have seen in past couple days here in Delhi(which was locked down earlier):

\- Many people are making excuses of getting groceries/milk/medicine to roam.

\- Some people are just treating it as picnic and roaming streets to see what a lock-down looks like. Local police was perplexed with this thought.

\- People who are in essential services are having hard time to get to their workplaces. For example: my sister is a Bio-medical engineer in local hospital and she is not able to book a cab or take local public transport. Today I went to drop her off and police stopped me twice to ask why I am out. We need to somehow make this easier. So essential services and their support can function.

<comment><USER5> My dad is a Doctor in U.P(state in India for people don't know) and he was on its way to see a critical patient, he was stopped more than 3 times by local police. Being Doctor and seeing a patient was not a good enough excuse, he said. After few minutes of questioning they let him go. But I think the Government should have some measures for this kind of situations.

<comment><USER6> You'd think having credentials at hand would be a 10-second check.

What a sad way of handling things.

<comment><USER7> Ah! You don't know nothing about the Indian state we are discussing. It's Uttar Pradhesh, sorta like Florida of India.

<comment><USER8> more like West Virginia of India.. Florida is a decent place, not that bad.

<comment><USER9> What about Bihar then

</comment></comment></comment></comment></comment></comment><comment><USER10> You might think that in a country the size and diversity of India that such a thing would be impossible to do. But I remember the curfew in 1984 after the Indira Gandhi assassination and it was surprisingly widespread. And I remember people helping each other in a frightening time.

Also newspapers continued to publish and be distributed.

Of course the country is so huge I only have my own experiences and that of family members (I happened to be traveling alone that day so had my own experiences).

<comment><USER11> I always see comments about how huge and ungovernable India is because of its diversity... doesn't it make sense to break India down into more governable nation-states then?

I read somewhere that there are districts in India with more people than the entire population of Norway!

<comment><USER12> That would never work due to external threats. If northern India became a separate nation state it would be vulnerable to invasion from China or Pakistan due to lack of strategic depth and limited resources.

<comment><USER11> If you broke India down, and with it the Hindu vs Muslim farce, there would be no reason for antagonism with Pakistan.

<comment><USER13> Wouldn't you just get a proxy buffer state like Afghanistan, Iraq, Syria? Doesn't sound like an improvement to the status quo.

<comment><USER11> None of those states make sense because they were built by colonialists drawing lines on a map without regard for native concerns. If Indians themselves sat down to divide India along actual ethno-cultural-linguistic lines we'd end up with better results. I'm not saying it's likely or even possible... just that if it were to happen, they might themselves be happier and more prosperous.

I don't know what that would look like because I don't know India that well, but I do know that the guys at work from Tamil Nadu are very different from the guys from Northern India. It's not a Texas vs California difference, it's a "we don't even have the same mother tongue" difference.

<comment><USER14> >it's a "we don't even have the same mother tongue" difference.

What is wrong with that? Belgium and the Netherlands are successful peaceful multilingual countries.

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> Punjab (the state I'm in atm) Police is handing out light punishment to anyone found flouting the rules of the curfew (Punjab is one of the states which have imposed full blown curfew instead of the lockdown).

Punishments include doing situps, holding ears, rolling around in the dirt, making lines in the dirt with your nose, and light beating with batons.

While some may consider it a human rights violation, I think it's much better than burdening the poor with criminal cases. In fact, in most of the cases people prefer to get this light punishment instead of getting charged with a crime.

<comment><USER16> Mandatory situps as a punishment sounds like a good idea honestly. I'd have no issues police offering that as an alternative to a fine in the UK for petty crimes.

Not so sure about the others though, but fair enough if it works for you guys.

<comment><USER17> police also executes people they deem unworthy of wasting courts time.

proof: [https://www.bbc.com/news/world-asia- india-50682262](https://www.bbc.com/news/world-asia-india-50682262)

<comment><USER18> " _Eschew flamebait. Don 't introduce flamewar topics unless you have something genuinely new to say. Avoid unrelated controversies and generic tangents._"

The parent comment had one foot on each iceberg, but this is completely unmoored.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

<comment><USER17> ok I was citing this as an example of slippery slope of this thought process

> I'd have no issues police offering that as an alternative to a fine in the > UK for petty crimes

It was completly criticized even india. pretty sure its not controversial flamewar.

Anyways. I understand. won't happen again.

</comment></comment></comment></comment></comment><comment><USER3> In general, though the government and police in India are acting with too blunt a force in this issue. Like UK PM mentioned even the need for going out of doors once per day for exercise, Indian PM says don't go out at all, which isn't practicable at all, since virtually all home delivery systems have been shut down (effectively, that is on paper essential services are to continue, but there is not enough framework done for that in many parts of the country, occasions where even the cops arrested the delivery people for curfew violation, and even more incidents where they were beat up).

Similary some states only allowing trucks with essential commodities to enter and exit. Now trucks coming with vegetables etc, often has to go back empty, but state not allowing entry/exit of empty trucks, likewise myriad issues of logistics are needed to be resolved.

<comment><USER19> Home delivery systems have been shut down??

<comment><USER20> No - Swiggy, Zomato, Amazon, Flipkart, Grofers, Medlife, 1Mg, PharmEasy and many more are functional, but at decreased capacity.

These services cater only to major cities though. The govt is looking to keep supply lines of essentials open even in villages and remote towns.

</comment></comment></comment><comment><USER21> There is no question of whether lockdown is needed or whether there was other alternatives.

But as usual with everything else, it's the poor who are going to be affected the most.

• Daily wage workers, as it implies should earn every day to feed their family. They have already faced the wrath of COVID-19 for past few weeks due to stoppage of certain work, now there will a complete halt.

•States do have public distribution schemes to distribute food ingredients at subsidised rate, certain states have announced making them free; yet there are several labourers who have travelled outside their states and they wouldn't be eligible to get it.

•Those who can stock up supplies have already did, in-spite of govt. requesting not to do so. Again, those who listened to the request (or) do not have the purchasing capacity would be the most affected in the coming days.

•Essential services personnel e.g. Garbage disposal, health workers, utilities etc. should be provided PPE; unfortunately most garbage disposal/sewage cleaners don't have gloves or masks even on normal days in most areas.

•Even if Govt. decides to send money to the poor directly, many don't have Bank Accounts.

Edit: It seems there was a need to clarify poor. For the sake of discussion, let's consider people below poverty limit($14-$17/month) as poor; i.e. 22% according to 2012 statistics but as you can see the limit itself is set very low when compared to standards of a developed country.

<comment><USER22> >it's the poor who are going to be affected the most.

since there's more poor than rich, thats just statistics. if you select 1000 random people, most of them will be poor.

<comment><USER21> Edited to include BPL as definition of poor.

</comment></comment></comment><comment><USER23> The US federal government has dug the graves of a million Americans by not doing the same already. Reality has a terrible way of smacking you in the face whether you accept it or not.

<comment><USER24> Nationwide lockdowns don't really work unless you are trying to totally contain it, which is likely impossible in the US, Europe, and India.

Each metro area and state should lock-down when they think they are going to get near their max ICU capacity (of course taking into account that hospital load lags by 2-3 weeks).

It doesn't do any good to lock down a city that doesn't have any community spread yet. It's just pure economic pain without any benefit.

<comment><USER25> There's no way to know that there is community spread without comprehensive testing.

In order to stop transmission, infected people need to be quarantined. If you have no idea which individuals are infected...the (incredibly painful, yes) alternative is _everyone_.

</comment></comment></comment><comment><USER26> It will be interesting to see if India is able to be effective in this lockdown. Unlike China, centralized control has been limited in recent history, even at the local level.

But as living standards have risen, some people have developed civic sense. Also, on the individual, family, and community level, there are many traditional practices that are similar to social distancing that, though they have some questionable origins in repressive social structures.

At least they are not in denial anymore.

<comment><USER3> Yes, but people are very afraid of police and authority in India, so Indian citizens can be made to comply if the police is deployed in force.

Where I think it would falter is in keeping the essential supplies running. Even todays PM speech contained no indication that essential services will have to be running. Without that lockdown could turn ugly.

<comment><USER27> There was an official document sent out on the official social media and traditional media channels that answers all these questions [1]. td:lr, essential services will continue to work

[1]: [https://twitter.com/ANI/status/1242476674710560770](https://twitter.com/ANI/status/1242476674710560770)

<comment><USER28> Is there no government website? How are people supposed to verify if something is "official"?

<comment><USER27> There is. But due to the unique social makeup of the internet in India, a lot of people can use social media on mobiles rather that visit websites. It's quicker to use social media for such notifications

</comment></comment></comment></comment></comment><comment><USER29> Currently in Bangalore. The one day curfew on Sunday was promising. Just a day before the curfew, you could find large groups of people playing cricket, basketball, going on walks, etc. That's mostly stopped, with the police strictly forcing people to disperse and go back home. A neighboring state chief minister just mentioned during a press meeting that people will be shot at sight if they leave their homes... without debating whether it's healthy to issue orders like that, I'm relatively confident that the quarantine will be executed effectively.

My concern though: the economic pressure of staying indoors will make a 3 week long (minimum) quarantine very tough. Based on certain sources, more than half the workforce are daily wage labors. Every day they don't work, they're not paid and they don't have insurances / safety nets to leverage.

Unless there's an influx of aid (from the government or otherwise) to help these folks pay for food / rent / pay back loans, etc. in the short term, there will be significant suffering, likely riot attempts and suicides. I'm already feeling significant panic from daily wage worker groups. There needs to be some kind of aid announcement ASAP to help them cope.

</comment><comment><USER30> Michael Ryan, executive director of the World Health Organization's Health Emergencies Programme, said that large, densely populated countries such as India will determine "the future of this pandemic." It is "exceptionally important" that India take aggressive steps to contain its spread

</comment><comment><USER31> India has also just approved the use of Hydroxychloroquine as a preventative measure with a doctor's prescription.

[https://economictimes.indiatimes.com/industry/healthcare/bio...](https://economictimes.indiatimes.com/industry/healthcare/biotech/pharmaceuticals/indias- covid-task-force-recommends-hydroxychloroquine-for-high-risk-patients-with- strict-riders/articleshow/74774540.cms)

</comment><comment><USER32> I would like to give everyone a different perspective of things

1\. As an Indian why do I believe community transmission has not started or rampant: Because our hospitals are not overrun with people with breathing issues

2\. Is this the right thing to do? Well, we don't have the capacity to treat the entire population, this we need to "cut the curve" rather than flatten it. Will this work? Your guess is as good as mine.

3\. Will people obey the curfew: I really hope so

4\. Should we test more? Sure maybe, but here is the thing we can't test someone once and be done with it, constant testing will be needed, and at our size, we can't do it, which is why I believe ICMR started with testing patients with some symptoms. Also, if people get the test, and they are negative, it might feel like a license to go back to regular life, which is a risk.

We are in uncharted waters. I really hope we can get to some scale in temperature surveillance at scale in the near future.

<comment><USER33> > I believe community transmission has not started or rampant: Because our > hospitals are not overrun with people with breathing issues

That is a serious, potentially fatal (literally!) mistake. One of the things that makes covid-19 so nasty is that it is transmissible long before the onset of symptoms.

<comment><USER34> This is still up in the air. The WHO says that, while there are documented cases of pre-symptomatic transmission, it is not the main driver of infection like with the flu, see: [https://www.who.int/dg/speeches/detail/who-director- general-...](https://www.who.int/dg/speeches/detail/who-director-general-s- opening-remarks-at-the-media-briefing-on-covid-19---3-march-2020)

"First, COVID-19 does not transmit as efficiently as influenza, from the data we have so far.

With influenza, people who are infected but not yet sick are major drivers of transmission, which does not appear to be the case for COVID-19.

Evidence from China is that only 1% of reported cases do not have symptoms, and most of those cases develop symptoms within 2 days."

This report is from March 3rd, so maybe our understanding has evolved.

<comment><USER35> > _This report is from March 3rd, so maybe our understanding has evolved._

A speech from the director-general. Not a report?

> _With influenza, people who are infected but not yet sick are major drivers > of transmission, which does not appear to be the case for COVID-19._

This is the same WHO that claimed _" no evidence of human to human transmission"_ not long ago. Regardless, iirc, the _R0_ for SARS-CoV-2 is estimated at 2.5 to 3.5, much higher than Influenza's, which is at 1.8. It doesn't matter if SARS-CoV-2 is spread by the infected yet not sick, because the _R0_ is significantly higher, plus the incubation period is too damn long and there's no therapeutic treatment nor a vaccine.

When the dust settles, and more conclusive and complete research is done to learn about the virus, we will have all the answers, but given the current state of affairs, imo, it is highly unlikely that SARS-CoV-2 is any less infectious than Influenza.

<comment><USER34> The method of infection matters. Singapore and Taiwan have done amazingly well specifically because they enforce quarantine of _infected_ individuals along with various levels of testing to identify those individuals, for example people having their temperature checked outside public buildings.

<comment><USER35> Fair point.

Does WHO reference any studies that prove asymptomatic folks don't infect others?

If you happen to know, what explains the higher _R0_ and higher rate of infection world-wide?

> _...for example people having their temperature checked outside public > buildings._

That isn't bullet-proof, tbh. India saw instances of people popping paracetamols to work around temperature checks.

<comment><USER34> Nothing is bulletproof, all we can do is take actions to reduce probability of transmission and the actions chosen should target the greatest drivers of transmission.

I am not aware of any studies but on the other hand it would be incredibly easy for cases of asymptomatic spread to actually have been infected by a symptomatic person, in a chaotic environment it's difficult to get good data.

</comment></comment></comment></comment></comment></comment></comment><comment><USER36> How does healthcare work there? Is there a free-to-use system? Insurance based? Someone tell us.

<comment><USER26> 80% of the population is uninsured [1]. They go to underresourced government or religious-charity run hospitals when severely ill but otherwise have limited access to medical care by western standards.

The upper middle class increasingly have insurance like people in the US, and the very wealthy pay for treatment directly. Both groups seek care at private hospitals that have equipment and staff that would rival those in wealthy countries - often set up and funded by Indian physicians abroad.

My family have to invested in such hospitals and I have toured them. No doubt they do charitable work on the margins, but they likely can't scale to a pandemic.

1\. [https://en.m.wikipedia.org/wiki/Health_insurance_in_India](https://en.m.wikipedia.org/wiki/Health_insurance_in_India)

<comment><USER37> There is a pseudo-insurance scheme called Ayushman Bharat[1] which is freely available for people below a specific income limit.

1\. [https://en.wikipedia.org/wiki/Ayushman_Bharat_Yojana](https://en.wikipedia.org/wiki/Ayushman_Bharat_Yojana)

<comment><USER38> That is however extremely underfunded, and has high rates of fraud.

<comment><USER26> It's also very new (started in September 2018), so it probably has nowhere near the institutional strength or depth (to say nothing of the funding) to deal with a pandemic of this scale. According to the wiki page:

"It covers 3 days of hospitalisation and 15 days of post hospitalisation, including diagnostic care and expenses on medicines."

3 days of hospitalization even with the best facilities is probably nowhere near enough for a serious COVID19 case.

Then again, health insurance providers in the US also recently balked quite strongly at the US administration's suggestion that they cover the full cost of COVID19 treatment, including co-pays:

[https://www.pbs.org/newshour/politics/ap-fact-check-trump- is...](https://www.pbs.org/newshour/politics/ap-fact-check-trump-is-wrong- about-insurers-covering-coronavirus)

How this all is paid for - and the delicate question about who has the right to the best treatment (those who can pay?) - are big issues that will soon be faced by health services and governments in all societies, whether wealthy or developing.

</comment></comment></comment></comment></comment><comment><USER39> I work with some Indians and heard them talk about kids in the street playing "corona tag" ....

Perhaps a lockdown might prevent those sorts of things ?

</comment><comment><USER40> Given the huge reliance on outsourced IT labor in India, I would curious to see how it would affect operations in the West. The pandemic is already affecting school's and testing centers that rely on online proctoring based in India - most of them not available at least until the end of the week (this is before the announcement).

<comment><USER41> It has already affected a major bank I work for - we have a lot of outsourced ops people in India and as of today, they're forbidden from coming to the office (while our policies forbid them from working from home, as they are contractors). The management is frantically scrambling to replace them with other random employees with zero hand-over. It's a mess.

<comment><USER42> I am in India and work full-time a US-based firm. We weren't permitted to work from home by our SOC department. But due to this situation we are being allowed to do it.

</comment></comment></comment><comment><USER43> Interestingly, Modi has not specified yet how people are supposed to get supplies. That should go over well.

<comment><USER44> This is being handled at the state level. Message copied from my city's facebook page: Due to corona virus threat there will be complete curfew in xxxx on 25th march 2020 also. public is requested to remain in their homes and not allowed to come out.

However milk, vegetables and other essential goods will be supplied to them at their home door to door by milkman, vendors and rehries etc. we are taking help of best price shop, swiggy, zomoto and other online companies and they will also be supplying grocery items door to door.

but when they reach in your locality , people should not crowd the vendor vehicle and should wait for it to come to their home. they should maintain the distancing norm of 5 feet while making purchase from them. all of them must wear mask and only one person should come out of the home to purchase from the cart. try to make payment online as far as possible.

General public is not allowed to come out of their homes during curfew. if anybody requires any pass to move in the curfew he should apply in the DC or CP office onlone.

However following persons can come out without passes during curfewbut some ID card of the Individual is Mandatory.

1\. Doctors & other Hospital Staff of Govt and Private Hospitals. 2\. Electricity and water supply Department Employees. 3\. Municipal Corporation Staff. 4\. ATMs/Banks. 5\. Private Security Guards going to duty in uniform. 6\. Patients having Medical Emergency cases. 7\. Telecom Company Employees on duty during office hours. 8\. All types of Goods/Fodder/Supplies carrying vehicles including Interstate goods vehilces. 9\. Patrol Pumps (06:00 AM to 08:00 PM) 10\. Hawkers of Recognised News papers (05:00 AM to 08:00 AM) 11\. LPG delivery vehicles for door to door supply (06:00 AM to 08:00 PM) 12\. Milk Plant vehicles and their Employees on duty.

<comment> frosted-flakes Is that quoted verbatim or did you translate it? It doesn't sound like language government officials would use.

<comment><USER44> Quoted verbatim actually. This post is by the police, not the government

</comment></comment></comment></comment><comment><USER3> Ultimately I think this has been a failure of containment and testing in India. The airport based checks has been abysmal, with reportedly much confusion and overcrowding. I wonder many of the people who got the virus got them in Indian airports at the time of their entry.

Also the quarantine legal framework is also no clear. In US people in federal quarantine are issued a quarantine form, indicating the duration, location and terms of medical review with automatic reviews every 72 hours. I have not heard of similar formalized quarantine scheme in India, rather much confusion abounds.

</comment><comment><USER45> This is just a slightly off-topic thought that I need to get off my chest, sorry for that.

Some time ago I read that Walt Disney (the person) was obsessed with washing his hands. He allegedly washed his hands every few minutes. I never gave this much attention, but if you consider that he was sixteen years old at the time of the Spanish Flu, and if you take a look at us now, this behavior suddenly becomes much more understandable. Let's all try to keep sane during in these strange times.

</comment><comment><USER46> A somewhat tangentally tech related question: Since (it seems that) all support is now done out of Indian call centers, how badly is this going to affect the ability to get support when needed?

As an example, should I expect support from, say, Cisco or Verizon (two companies that I know from recent experience are running their support orgs out of India), to simply up and cease to exist? Will it somehow get more frustratingly difficult than it is already Or should I expect business as usual?

</comment><comment><USER47> Is working from home a possibility for the tens of millions of developers and call center workers?

How's India's internet access at homes? I lived in S. India about a decade ago, and the internet was okay at the various IT offices, but it seemed a lot of office workers used their work PCs for a lot of personal business like banking and media (i.e. after hours), and I assumed this was because access was poor in home residences.

But maybe it has improved in the last decade.

<comment><USER9> It's now better, I am currently in India with 500mbps uplink through local ISP.

</comment></comment><comment><USER48> Indians are practicing Untouchability for 2700 years [https://en.wikipedia.org/wiki/Rigveda](https://en.wikipedia.org/wiki/Rigveda)

#SocialDistancing is not different/difficult [http://archive.vn/bEMTt](http://archive.vn/bEMTt)

</comment><comment><USER49> Indian here in the midst of things .Overall I think this is the best possible decision modi can take and the public (here in Hyderabad at least) are taking this very seriously , compared to a week ago I can hardly see a single person on the road . Police are there at almost all major signals checking for reasons why people are outside.

</comment><comment><USER50> The reaction is good, in a way that it buy government and other institutions time to work out better way to tackle this emergency. I think other countries are not so keen to take such actions, why is that ? What should be better solution in long run for the world as a whole ?

<comment><USER3> But it required a huge amount of continued police presence and threat of vacuous criminal action on top of peoples natural fear for life to achieve that. Police has been using force on people on the last 2,3 days. That would be deemed unacceptable in most advanced countries.

<comment><USER42> Such draconian measures had to be used as many people aren't exactly serious in India. There are people who are using this situation for "family get- togethers" and other types of fun activities. The PM literally had to plead everyone to remain at their homes.

</comment></comment></comment><comment><USER51> The whole thing about warmer region being less infected is still very much controversial, and not backed by any strong science.

India, like other warmer regions, has not been very active in the diagnostic. This is also what explains the low numbers you in Africa, Middle-East, and part of Asia.

Right now there is only one way that we currently have to stop this, and it is to do it Wuhan-style. Full lockdown for 8 weeks.

And forget about chloroquinone, studies published over the past 2 days are showing that it doesn't make a dent if you are already infected.

<comment><USER52> Louisiana is not slouching in number of infected cases so that should put paid to warm weather hypothesis

<comment><USER51> What are you talking about? Louisiana as a over a 1100 cases and they went in shutdown mode yesterday!

<comment><USER52> Is not slouching meaning they have plenty, so warm weather is not a panacea. I live here, I know.

</comment></comment></comment></comment><comment><USER53> Culturally (I realize India is multi-cultural), are Indian people more likely to wear masks when out in public during times of a pandemic?

<comment><USER44> Haven't seen it ever happen before. But this time is different. I am seeing almost no one without a mask outside.

</comment></comment><comment><USER54> It's a cute thought. Maybe this will drive India towards improving their internet, healthcare and infrastructure. One can dream...

</comment><comment><USER55> India, a country where today 18 million people live in slavery – which is the highest number of slaves in the world – will probably not handle COVID-19 well.

As someone who has been in India for some time, everything else than a catastrophe would astonish me.

Source: [https://blogs.wsj.com/indiarealtime/2016/06/02/india-has- the...](https://blogs.wsj.com/indiarealtime/2016/06/02/india-has-the-most- people-living-in-modern-slavery/)

<comment><USER56> This is a definite troll post but lets analyze. You posted a single source for a pretty non-sensical comment. The link posts to a study by the Walk Free foundation - a foundation owned by an Australian billionaire who made his fortune in mining and who once ran a 38M AUD campaign to subvert a government imposed tax. Ironically this foundation publishes a Global Slavery Index. Thank you for the free education.

<comment><USER55> Slavery is a huge problem in India. Who did burn the bricks of your house → there is a high chance in India that they where fabricated by slaves. If you are an Indian you know that. You also know that those numbers are always estimates, but they are not totally off.

I know Indians are proud, very proud, but seen from an outside view the Indian society has a lot of problems. You can deny it, but you can't hide it, there is just too much wrong.

India has a lot of beautiful things to offer. I just hope that not too many people will suffer there.

</comment></comment></comment><comment><USER57> > Modi has claimed that there are not yet signs of community spread

Do they have any reason to believe that there's something special about the borders of India that cause the virus _not_ to spread inside it? If not, this is an irrelevant observation. It's like jumping off a cliff and saying "there are not yet signs of the ground."

<comment><USER58> They are not doing enough testing, so of course they don't know and that's why the numbers are low.

<comment><USER50> And they know it hence the reaction.

</comment></comment></comment><comment><USER59> If we don't have a plan for what to do when quarantine ends, we're just kicking the can down the road.

So... what's going to be different about our response in April or May or when people come out of quarantine? Or are we just hoping it goes away?

Personally I think allowing the young and healthy to interact makes sense. They generally don't need hospitalization and they can start to develop antibodies and our heard immunity.

<comment><AUTHOR> > _we're just kicking the can down the road_

Google "flatten the curve" [1]. The point of a quarantine isn't to stop the infection. It's to slow it down so it doesn't overwhelm healthcare infrastructure.

Given India's population and ICU capacity, a fast spread could kill tens of millions.

[1] [https://www.nytimes.com/2020/03/11/science/coronavirus- curve...](https://www.nytimes.com/2020/03/11/science/coronavirus-curve- mitigation-infection.html)

<comment><USER59> I should have anticipated this response as it's become as much of a meme as has "it's just a flu."

We're flattening the curve too much here in Seattle. There are 100 new cases identified each day.

So we've flattened the curve to last... 60 years of quarantine.

We need to curve the curve. But instead they announced more restrictions.

<comment><AUTHOR> > _There is 100 new cases identified each day_

Out of those tested. A minuscule fraction of the population is being tested. Case count is massively undrepresecnts the current infected and thus future near-morbid. The evidence for this is in the increasing case count even among the sample being tested.

China is getting back to normal life after a seemingly-effective program of quarantine and testing. Korea and Taiwan look similar. Refusing to quarantine early enough, long enough and resolutely enough leaves us looking like Italy. Far more damaging and chaotic for the economy and civic society.

<comment><USER59> Actually testing has gone up exponentially in Seattle.

But we're still finding a flat line of infections. Which suggests it's slowed dramatically.

That sounds like good news, but we're seemingly past containment, so it does seem like we're kicking the can down the road.

<comment><AUTHOR> > _testing has gone up exponentially in Seattle_

Still an immaterial fraction of the population being tested.

> _we're seemingly past containment_

Containment has failed. Doing nothing after containment is a good way to decimate one's population and cause it lasting economic harm.

</comment></comment></comment></comment></comment></comment><comment><USER60> CoronaVirus So far affected Rich Countries significantly higher than poor countries (Only China where it originated and Iran are exceptions).

One Theory is people in rich countries have less immunity. (Africa, India etc have better immunity since the countries are used to poor hygienic conditions since young ages and develop better immunity).

I added Per Capita income of the country to Johns Hopkins Coronavirus Resource Center Chart: [https://imgur.com/bbCzab2](https://imgur.com/bbCzab2)

Edit: I see down votes. Note that Travel between Vietnam and China has been significant (similar to west) but Vietnam is not severely impacted.

<comment><USER61> This usually doesn't work with novel viruses.

A more plausible explanation is that chinese immigration into India is tiny. So we're one or two degree removed from the original epicenter. But it's only a matter of time, now that the epicenter has moved to the west.</comment></comment>


Source Code Policy: Introduction for Public Comment - <AUTHOR> https://sourcecode.cio.gov/ <comment><USER2> Maybe appending "\- Request for Public Comment" to the title would make it more descriptive.

 _... today the White House Office of Management and Budget (OMB) is releasing a draft policy to improve the way custom-developed Government code is acquired and distributed moving forward. This policy is consistent with the Federal Government's long-standing policy of ensuring that "Federal investments in IT (information technology) are merit-based, improve the performance of our Government, and create value for the American people."2

This policy requires that, among other things: (1) new custom code whose development is paid for by the Federal Government be made available for reuse across Federal agencies; and (2) a portion of that new custom code be released to the public as Open Source Software (OSS).

We welcome your input on this innovative draft policy ..._

<comment><AUTHOR> Unfortunately I'm seeing this too late for the edit, but thanks for the suggestion. I didn't want to hack the title per policy but I think you're right.

</comment></comment><comment><USER3> Here's the press release accompanying the release of the draft policy: [https://www.whitehouse.gov/blog/2016/03/09/leveraging- americ...](https://www.whitehouse.gov/blog/2016/03/09/leveraging-american- ingenuity-through-reusable-and-open-source-software)

</comment><comment><USER4> I think this an exciting policy proposal and I'm very interested to see what sort of feedback may result.

Disclaimer: Involved in the planning stages for a custom development project under contract for the Army Corps of Engineers. My personal opinion is that it qualifies for this policy and that it is a good policy moving forward. So far I have absolutely no idea of the opinions of my employer, much less the staff we are working with at the Army Corps of Engineers.

</comment><comment><USER5> This makes a lot of sense - also makes me laugh about how many times they've previously duplicated software in different offices.</comment>


Alibaba Is Conquering Africa, Where Is Amazon? - <AUTHOR> https://phonereviewzone.com/aliexpress-buy-phones-and-phone-accessories-affordably/ <comment><AUTHOR> why is it that Amazon has refused to do business in Africa? Already Alibaba's AliExpress allows African customers to buy products from China and ship them for free. Unlike Amazon, you also don't pay overquoted taxes.</comment>


Yahoo buys Associated Content for $100 million - <AUTHOR> http://www.businessinsider.com/yahoo-buys-associated-content-for-100-million-2010-5

<comment><USER2> Is it safe to say that Yahoo is no longer a tech company?</comment>


Shell Fu in zsh - <AUTHOR> http://blog.nodenexus.com/2015/04/09/extending-zsh-functionality/

<comment><USER2> Crazy scrolling issues in mobile safari. Getting the orange background at the bottom as if the whole page is scrolling past its ends while the content crawls past. Even when that settles, scrolling is jarringly stopping and starting, with no deceleration. Please don't try to re-implement native browser scrolling poorly :(</comment>


The top gun in India's premium smartphone segment is neither Apple nor Samsung - <AUTHOR> https://www.techinasia.com/oneplus-beats-apple-samsung-top-premium-smartphone-segment-india <comment><USER2> That's impressive to me. I'm actually shocked to see Apple dominating so much in a country I wouldn't have expected their phones to be very affordable. Are they heavily subsidized?

IMO, One Plus seems to have made great strides with good direction into the industry.

I still have my OPO sitting on my desk, I cracked the screen again (damaged the rubber brace around it replacing it the first time, underestimated it's job...) and I just ordered a new one off Ebay for $5, with tools. I plan to try and run Arch Linux ARM on it and see if I can make it a mobile web server.</comment>


The Rise & Fall of a Billionaire Technology Hedge Fund Guru - <AUTHOR> http://gigaom.com/2009/10/16/the-rise-fall-of-a-billionaire-technology-hedge-fund-guru/ <comment><USER2> I don't know how you can go from a single case to "That is all poppycock." Hedge funds are thirsty for information; it's not unprecedented for him to have been a legitimate operator who fooled himself into thinking he could get away with one big illegal trade.

This guy's net worth was five times that of Boesky -- could he have gotten away with five times the chicanery, especially _after_ enforcement was stepped up thanks to Boesky et al.?

</comment><comment><USER3> I just can't believe how foolish he was. He is a _billionaire_ \- he does not need to put on any inside trades at all. The risk to reward on that trade made it an incredibly bad trade to take. Boggles my mind.

</comment><comment><USER4> I'd wager most hedge funds are heavily into inside trading. The best strategy will always be exploited.</comment>


Feds Bust Cookie-Stuffing Code Seller - <AUTHOR> http://www.wired.com/threatlevel/2010/02/feds-bust-cookie-stuffing-code-seller/ <comment><USER2> So writing software to allow someone to cause a server to return the string "Set-Cookie: " with the wrong unique ID after it is "conspiracy to commit wire fraud" now.

I don't like people that try to scam affiliates out of their money, but I also don't like the precedent that this sets. How long until the author of an open- source web server is liable for the child-porn someone serves with it?

<comment><USER3> Probably as soon as someone creates a web server especially for child porn, with a list of features designed expressly to help child porn traffickers, and marketed as the best child porn server out there.

I'm not thrilled about this either, but this guy didn't write this software for any other purpose or market it for any other purpose.

<comment><USER2> _Probably as soon as someone creates a web server especially for child porn, with a list of features designed expressly to help child porn traffickers, and marketed as the best child porn server out there._

Tor?

</comment></comment></comment><comment><USER4> Interesting... especially since I consider paying for advertising "per click" fraudulent as well. In what other form of advertising do you get the brand recognition, message delivery, word of mouth, and all of the ancillary bits of advertising that actually makes it work completely for free? No other method. Because content producers and advertising companies in every single other medium understand how advertising works, and understand that only paying when the ad results in a direct IMMEDIATE sell amounts to them defrauding the content providers. I can get my message seen by thousands of users and only pay for a tiny little fraction of that? I can certainly see how that would be an ethical challenge for a company, wanting to get 90%+ of an advertisements benefit without paying for it, but it's pretty clearly unethical to rip people off in such a way.

Call me if you see a magazine, TV, or radio ad that was carried for free and agreed to only accept a payment when a customer shows up and specifically mentions the exact ad that inspired them to make the purchase.

</comment><comment><USER5> Sounds like big case #2.

The other recent cookie stuffing case was last April when three people, including the owner of the massive Digital Point forums, were charged with defrauding eBay as well:

[http://www.courthousenews.com/2008/08/26/eBay_Sues_Alleged_C...](http://www.courthousenews.com/2008/08/26/eBay_Sues_Alleged_Cookie_Stuffers_.htm)

</comment><comment><USER6> This seems like a good bust. If an affiliate contracts to advertise for compensation, and they finagle payment without advertising, that's plain fraud. The guy who helps them do it has aided and abetted.</comment>


In Defense of 'Ghost in the Shell' (2017) - <AUTHOR> https://medium.com/@gitsost/in-defense-of-ghost-in-the-shell-2017-b23f41880666 <comment><USER2> The movie wouldn't even exist without all the mean people who said mean things about it. They weren't being jerks, they were disappointed in a remake of something they have loved for a long time.

Personally, I think the movie could have just been a two-hour examination of the futuristic city they designed, which was beautiful and enthralling. The actual story was not very interesting at all.

<comment><AUTHOR> The vast majority of the negativity I saw online wasn't from people who liked the original though, it was backlash to the casting. And the over-the-top hate for this movie is a genuine phenomenon; it's been months since the movie was out yet I got so much flack on various places online after I wrote this article that I felt like this (lol): [http://imgur.com/a/oUL4z](http://imgur.com/a/oUL4z)

My point is just to tell people who've only heard negative things (it bombed, it got bad reviews, etc.) to not be afraid to check it out. I don't think it's a bad movie and it's okay to draw one's own conclusions.

</comment></comment><comment><USER3> My problem with the new movie is that its only good parts felt like cheap remakes of bits of the old movie, and it left the best parts behind. There's no reason to watch the new one if you saw and liked the old one.

<comment><USER4> "There's no reason to watch the new one if you saw and liked the old one."

This deserves to be said more often, and holds for many other remakes.</comment></comment>


A Practical Guide to Breaking into Computer Sci - <AUTHOR> https://spin.atomicobject.com/2017/10/20/breaking-into-software-dev/#.WenzOnjbyXU.hackernews <comment><USER2> Software development is not the same thing as computer science.</comment>


Download iOS 6 GM Build IPSW For Your iDevices [Direct Links]   - <AUTHOR> http://cydiaism.com/ios-6-gm-build-available-for-to-download-direct-links/

<comment><AUTHOR> Download links are live now</comment>


Show HN: Chrome and Firefox plugins for BeeLine Reader - <AUTHOR> http://beelinereader.com/install

<comment><AUTHOR> When we did our Show HN a couple months ago, people when we were going to have browser plugins. We now have plugins available for Chrome and Firefox, and they support multiple font sizes and custom colors. Please let us know if they work on the sites you read, and how we can make them better!</comment>


Fexl Version a3 now released - <AUTHOR> http://fexl.com/code

<comment><AUTHOR> The code page now includes some simple instructions for doing a quick download and test.

I also made a very nice but simple enhancement to the grammar. Now when you want to do a recursive definition, you must use "==" instead of the normal "=". That might sound like a pain, but bear with me, it's really great. In short, the "==" syntax announces to the parser that you _intend_ to apply the fixpoint operator (Y combinator) to the definition, explicitly making it recursive.

For example, here is the function which sums the numbers in a list:

      \sum == (\list list 0.0 \head\tail double_add head; sum tail)

Of course, if you don't like saying double_add everywhere, you can easily abbreviate as follows:

      \add=double_add
      \sum == (\list list 0.0 \head\tail add head; sum tail)

Now here's the great thing about requiring "==" for recursive definitions. It enables us to do ordinary "procedural" looking code, like in this snippet from test_procedural in test/try.fxl:

      \show=(\name\value print name; print " = "; print value; nl;)

      \x=3.0
      \y=4.0

      \x=(add x x)
      \y=(mul y x)

      show "x" x; show "y" y;

      \x=(div x; mul y 4.0)
      show "x" x; show "y" y;

      \z=(mul x; mul y; add 1.0 y)
      show "x" x; show "y" y; show "z" z;

      \z=(div z 5.0)
      show "z" z;

In other words, you can do incremental calculations which look like destructive assignment, but really aren't.

In the old version "a2", a definition like this would have yielded infinite recursion:

      \x=(add x x)

Now it actually means something useful.</comment>


Plotly: The Web's first scientific graphing app - <AUTHOR> https://plot.ly Make scientific-quality graphs and run statistics and regressions - All in your browser. <comment><USER2> Oh, also, nice examples: [https://plot.ly/#gallery](https://plot.ly/#gallery). And R, Python, Matlab, Julia, and PERL libraries: [https://plot.ly/api...Nice](https://plot.ly/api...Nice)!

</comment><comment><USER3> Well done guys. For good insights on how you could approach some UX challenges in a tool like Plotly, I highly recommend watching Bret Victor's "Drawing Dynamic Visualizations".

For the non-Plotly folks reading this, Bret's presentation is also very effective at blowing your mind in general.

[http://vimeo.com/66085662](http://vimeo.com/66085662)

<comment><AUTHOR> Thanks! We are indeed _huge_ fans of @worrydream

</comment></comment><comment><USER4> And check out the python script that generated the graph ([https://plot.ly/~bchartoff/157](https://plot.ly/~bchartoff/157)) to pick and choose favorite layout elements, for example.

</comment><comment><USER5> I saw a demo in person the other day and they showed it as a graph embedded in a Washington Post article. I was most impressed by the ability to click through on the graph and browse or query the data set directly.

<comment><AUTHOR> Here's one of the recent Washington Post articles with an embedded Plotly graph: [http://wapo.st/13osx4W](http://wapo.st/13osx4W)

<comment><AUTHOR> Here's the most recent embedded Plotly graph in the Washington Post: [http://wapo.st/19zFL1B](http://wapo.st/19zFL1B)

</comment></comment></comment><comment><USER6> What changed since your last post ([http://news.ycombinator.com/item?id=5671831](http://news.ycombinator.com/item?id=5671831)) ?

<comment><AUTHOR> Lots! We long since incorporated all of the suggestions from that post, including building a cross-language graphing API for Python, Julia, MATLAB, R, et al. We've also had time since then to raise a seed round, smooth out the UX and aesthetic, build more features like ability to comment on graphs, and build the team past the original 2.5 engineers from the time of that post ([https://plot.ly/about](https://plot.ly/about)). There are also many, many more graph types: box plots, histograms, error bars, area plots, and multiple axes and subplots coming very soon. Thanks for following and asking! Most of the HN readership likely graphs data regularly, so its been especially rewarding and fascinating to solicit feedback from y'all.

</comment></comment><comment><AUTHOR> Thoughts? NYT-quality graph made in Plotly: [https://plot.ly/~bchartoff/344/](https://plot.ly/~bchartoff/344/)

</comment><comment><USER7> Plotly is awesome...I show it to everyone I can, and use it to present awesome graphs at lab meetings almost every week.

</comment><comment><AUTHOR> Any scientists or engineers out there have any thoughts or suggestions? Would you use this at your job or in your lab?

</comment><comment><USER8> Really, really beautiful. Well done.

</comment><comment><USER9> Another successful app made with D3.js!

</comment><comment><USER10> Really fantastically fantastic.</comment>